.gitea/workflows/test-ci.yml

@@ -1,21 +1,34 @@
 name: DevSecOps Pipeline - V1 Infrastructure
 
-on: [push]
+on: [push, pull_request]
 
 jobs:
-  health-check:
+  lint-and-format:
-    name: System & Environment Check
+    name: Code & Config Linting (Yamllint & Hadolint)
     runs-on: host
     steps:
-      - name: System Check
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Yamllint
         run: |
-          echo "Pipeline CI/CD opérationnel sur le VPS RYM !"
+          echo "🧹 Verification de la syntaxe YAML..."
-          uname -a
+          podman run --rm -v "$PWD":/data:z cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" .
-          podman --version
+
+      - name: Run Hadolint (Dockerfiles)
+        run: |
+          echo "🐳 Analyse des Dockerfiles..."
+          # Ne s'execute que si des Dockerfiles existent dans le repo
+          if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then
+            podman run --rm -i docker.io/hadolint/hadolint < Dockerfile
+          else
+            echo "Aucun Dockerfile détecté, étape ignorée."
+          fi
 
   gitleaks-scan:
     name: Secret Detection (Gitleaks)
     runs-on: host
+    needs: lint-and-format
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -35,5 +48,5 @@ jobs:
 
       - name: Run Trivy IaC Scan
         run: |
-          echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
+          echo "🛡️ Analyse des configurations d'infrastructure..."
           podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path